The malicious payload is any one of a number of domains hosted on 174.140.171.233 which is also being used in this attack. Blocking the IP is the easiest way to protect against the malicious sites hosted on that server.